kali/DailyMotion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 修复图像服务接口中的路径越界访问和文件不存在错误处理

Browse Source
This commit is contained in:
晓丰 2025-06-06 22:58:51 +08:00
parent 848f21b609
commit 101a819663
1 changed files with 17 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
screenshots_flask.py
View File

@ -10,19 +10,26 @@ SCREENSHOTS_DIR = PROJECT_ROOT / "screenshots"
@app.route('/image/<path:filename>') @app.route('/image/<path:filename>')
def serve_image(filename): def serve_image(filename):
file_path = SCREENSHOTS_DIR / filename app = Flask(__name__)
# 防止路径越界访问 PROJECT_ROOT = Path(__file__).parent.resolve()
try: SCREENSHOTS_DIR = PROJECT_ROOT / "screenshots"
file_path.resolve().relative_to(SCREENSHOTS_DIR.resolve())
except ValueError:
abort(403, "禁止访问目录外文件")
if not file_path.exists(): @app.route('/image/<path:filename>')
abort(404, "文件不存在") def serve_image(filename):
file_path = SCREENSHOTS_DIR / filename
return send_file(file_path, as_attachment=False) # 防止路径越界访问
try:
file_path.resolve().relative_to(SCREENSHOTS_DIR.resolve())
except ValueError:
abort(403, description=f"禁止访问目录外文件: {file_path.resolve()}")
if not file_path.exists():
abort(404, description=f"文件不存在: {file_path.resolve()}")
return send_file(file_path, as_attachment=False)
if __name__ == '__main__': if __name__ == '__main__':
app.run(host='0.0.0.0', debug=False, port=5000) app.run(host='0.0.0.0', debug=True, port=5000)